11

I'm running an ubuntu image in a docker container, with my .ssh directory mounted from my native MacOs environment.

My .ssh/config file contains

Host *
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519_common

This works fine on a mac, but AddKeysToAgent and UseKeychain are not valid for linux, and anything (e.g. git) that uses the openssh-client package won't just ignore the unrecognised directives, but fail and exit.

Is there any way of having a .ssh/config file that will let me share it across mac and linux?

1
  • I suggest that a better title for this question is "Can i make some entries in ssh config conditional to platform to enable mac+linux sharing?" Jul 8, 2019 at 17:00

2 Answers 2

14

You can use the Match keyword in the ssh config file to restrict a portion of the configuration to only apply under certain conditions. For the excerpt in the question, something like the following should work:

Host *
    AddKeysToAgent yes
    IdentityFile ~/.ssh/id_ed25519_common

Match exec "uname -s | grep Darwin"
    UseKeychain yes

On a linux system, the grep will return failure (1), and so the following line(s) will be ignored; on the Mac host, the grep will return success (0) and the UseKeychain yes line will be applied.

The Match block is terminated by the next Match, Host, or end of file.

Note that AddKeysToAgent is not platform-specific, but is available in OpenSSH since version 7.2, so presumably you are using an older version of OpenSSH in the Ubuntu container but not on the Mac host.

5
  • 1
    should you use grep -q here?
    – Joshua
    Jul 8, 2019 at 15:17
  • 1
    @Joshua the command from the exec will be run with its stdout redirected to /dev/null, so I don't think that makes a difference. But this answer doesn't seem to work, anyways. It will complain about the unknown directive irrespective of whether the Match condition succeeded or failed. Moreover, if the condition is Match exec "sleep 30; exit 19", it will dutifully sleep 30 seconds, then complain about any unknown directive and die ;-)
    – mosvy
    Jul 8, 2019 at 18:03
  • @MEHColeman could you please mention the exact version of ubuntu and ssh where this worked; I'm just not able to make it work with any version of openssh -- not even the last openssh-portable. But maybe the ubuntu people have some special patches for it.
    – mosvy
    Jul 8, 2019 at 18:11
  • @mosvy Aah, I unconsciously fixed an error with the answer above - the Match keyword should be indented as the other keywords are. This works on ubuntu 18:04. I have openssh-client (1:7.6p1-4ubuntu0.3) installed. The other answer here also works perfectly)
    – MEHColeman
    Jul 11, 2019 at 10:40
  • @mosvy's answer is the correct response. I'd delete this one, but I can't delete an accepted answer. Jul 15, 2019 at 11:36
10

You should use the IgnoreUnknown directive early on in your ~/.ssh/config:

IgnoreUnknown   UseKeychain,AddKeysToAgent

From the ssh_config(5) manpage:

IgnoreUnknown

Specifies a pattern-list of unknown options to be ignored if they are encountered in configuration parsing. This may be used to suppress errors if ssh_config contains options that are unrecognised by ssh(1). It is recommended that IgnoreUnknown be listed early in the configuration file as it will not be applied to unknown options that appear before it.


On all versions of openssh I could test, a failing Match condition will not prevent ssh from erroring out on any following directives unknown to it:

$ cat ~/.ssh/config
Match !all
        Foobar yes
$ ssh localhost
/home2/ahq/.ssh/config: line 2: Bad configuration option: foobar
/home2/ahq/.ssh/config: terminating, 1 bad configuration options
1
  • 1
    This answer also works perfecty. Thanks!
    – MEHColeman
    Jul 11, 2019 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.